127 if ((
Cookie & 0xF0000000) ||
130 DPRINT1(
"LdrUnlockLoaderLock() called with an invalid cookie!\n");
346 DPRINT1(
"[%p, %p] LDR: Recursive DLL Load\n",
349 DPRINT1(
"[%p, %p] Previous DLL being loaded \"%wZ\"\n",
353 DPRINT1(
"[%p, %p] DLL being requested \"%wZ\"\n",
361 DPRINT1(
"[%p, %p] LDR: No DLL Initializer was running\n",
367 DPRINT1(
"[%p, %p] DLL whose initializer was currently running \"%wZ\"\n",
396 "LDR: %s - failing because LdrpLoadDll(%wZ) returned status %x\n",
465 NextEntry = ListHead->
Flink;
466 while (NextEntry != ListHead)
487 NextEntry = NextEntry->
Flink;
494 "LDR: %s() exiting 0x%08lx\n",
523 RtlInitEmptyUnicodeString(&RawDllName,
NULL, 0);
524 RedirectName = *DllName;
525 pRedirectName = &RedirectName;
533 if (DllHandle) *DllHandle =
NULL;
539 DPRINT1(
"Flags are invalid or no DllHandle given\n");
559 DPRINT1(
"LdrpApplyFileNameRedirection FAILED: (Status 0x%x)\n",
Status);
609 p1 = pRedirectName->
Buffer;
618 else if (*p1 ==
L'\\')
625 if (!(p2) || (*p2 ==
L'\\') || (*p2 ==
L'/'))
685 DPRINT1(
"LDR: LdrGetDllHandleEx, searching for %wZ from %ws\n",
740 if (DllHandle) *DllHandle = LdrEntry->
DllBase;
822 DPRINT(
"LdrVerifyImageMatchesChecksum() called\n");
837 DPRINT1 (
"NtCreateSection() failed (Status 0x%x)\n",
Status);
856 DPRINT1(
"NtMapViewOfSection() failed (Status 0x%x)\n",
Status);
869 DPRINT1(
"NtMapViewOfSection() failed (Status 0x%x)\n",
Status);
899 if (ImageCharacteristics)
915 while (ImportData->
Name)
963 DPRINT(
"LdrQueryProcessModuleInformation() called\n");
977 ModuleInformation->NumberOfModules = 0;
978 ModulePtr = &ModuleInformation->Modules[0];
1010 InitListHead = &
NtCurrentPeb()->Ldr->InInitializationOrderModuleList;
1011 InitEntry = InitListHead->
Flink;
1013 while (InitEntry != InitListHead)
1021 if (InitModule == Module)
break;
1024 InitEntry = InitEntry->
Flink;
1046 if (ModuleInformation)
1047 ModuleInformation->NumberOfModules++;
1066 DPRINT(
"LdrQueryProcessModuleInformation() done\n");
1109 ListHead = &
NtCurrentPeb()->Ldr->InLoadOrderModuleList;
1110 ListEntry = ListHead->
Flink;
1111 while (ListHead != ListEntry)
1133 ListEntry = ListEntry->
Flink;
1300 RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED
ActCtx;
1302 ULONG ComSectionSize;
1335 RtlActivateActivationContextUnsafeFast(&
ActCtx,
1342 RtlDeactivateActivationContextUnsafeFast(&
ActCtx);
1364 InInitializationOrderLinks);
1365 NextEntry = NextEntry->
Blink;
1368 LdrEntry->
Flags &= ~LDRP_UNLOAD_IN_PROGRESS;
1376 DPRINT1(
"(%lu) [%ws] %ws (%lx) deinit %p\n",
1392 CurrentEntry = LdrEntry;
1415 CurrentEntry =
NULL;
1425 CurrentEntry = LdrEntry;
1442 DPRINT1(
"LDR: Calling deinit %p\n", EntryPoint);
1451 RtlActivateActivationContextUnsafeFast(&
ActCtx,
1464 DPRINT1(
"WARNING: Exception 0x%x during LdrpCallInitRoutine(DLL_PROCESS_DETACH) for %wZ\n",
1470 RtlDeactivateActivationContextUnsafeFast(&
ActCtx);
1475 CurrentEntry =
NULL;
1480 NextEntry = UnloadList.
Flink;
1481 while (NextEntry != &UnloadList)
1485 NextEntry = NextEntry->
Flink;
1486 CurrentEntry = LdrEntry;
1508 DPRINT1(
".NET Images are not supported yet\n");
1530 DPRINT1(
"We don't support Hotpatching yet\n");
1578#define STATUS_MUI_FILE_NOT_FOUND ((NTSTATUS)0xC00B0001L)
NTSTATUS NTAPI NtUnmapViewOfSection(IN HANDLE ProcessHandle, IN PVOID BaseAddress)
NTSTATUS NTAPI NtCreateSection(OUT PHANDLE SectionHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN PLARGE_INTEGER MaximumSize OPTIONAL, IN ULONG SectionPageProtection OPTIONAL, IN ULONG AllocationAttributes, IN HANDLE FileHandle OPTIONAL)
NTSTATUS NTAPI NtMapViewOfSection(IN HANDLE SectionHandle, IN HANDLE ProcessHandle, IN OUT PVOID *BaseAddress, IN ULONG_PTR ZeroBits, IN SIZE_T CommitSize, IN OUT PLARGE_INTEGER SectionOffset OPTIONAL, IN OUT PSIZE_T ViewSize, IN SECTION_INHERIT InheritDisposition, IN ULONG AllocationType, IN ULONG Protect)
IN PUNICODE_STRING StaticString
IN PUNICODE_STRING IN PUNICODE_STRING DynamicString
static BOOL CALLBACK EnumProc(_In_ HWND hWnd, _In_ LPARAM lParam)
static BOOL CompareName(LPCWSTR pszName1, LPCWSTR pszName2)
PVOID NTAPI RtlAllocateHeap(IN PVOID HeapHandle, IN ULONG Flags, IN SIZE_T Size)
BOOLEAN NTAPI RtlFreeHeap(IN PVOID HeapHandle, IN ULONG Flags, IN PVOID HeapBase)
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES IN DWORD Unknown3
#define STATUS_NOT_IMPLEMENTED
#define NT_SUCCESS(StatCode)
#define DLL_PROCESS_DETACH
#define RtlImageDirectoryEntryToData
#define RemoveEntryList(Entry)
#define InsertTailList(ListHead, Entry)
#define InitializeListHead(ListHead)
IN PLARGE_INTEGER IN PLARGE_INTEGER PEPROCESS ProcessId
_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE FileHandle
#define FLG_HEAP_ENABLE_TAIL_CHECK
NTSYSAPI BOOLEAN WINAPI RtlDllShutdownInProgress(void)
#define EXCEPTION_EXECUTE_HANDLER
long __cdecl _InterlockedIncrement(_Interlocked_operand_ long volatile *_Addend)
LIST_ENTRY * ModuleListHead
LONG LdrpLoaderLockAcquisitionCount
NTSTATUS NTAPI LdrGetDllHandle(_In_opt_ PWSTR DllPath, _In_opt_ PULONG DllCharacteristics, _In_ PUNICODE_STRING DllName, _Out_ PVOID *DllHandle)
NTSTATUS NTAPI LdrUnloadDll(_In_ PVOID BaseAddress)
NTSTATUS NTAPI LdrAccessOutOfProcessResource(IN PVOID Unknown, IN PVOID Image, IN PVOID Unknown1, IN PVOID Unknown2, IN PVOID Unknown3)
NTSTATUS NTAPI LdrFindCreateProcessManifest(IN ULONG Flags, IN PVOID Image, IN PVOID IdPath, IN ULONG IdPathLength, IN PVOID OutDataEntry)
#define STATUS_MUI_FILE_NOT_FOUND
NTSTATUS NTAPI LdrQueryProcessModuleInformationEx(_In_opt_ ULONG ProcessId, _Reserved_ ULONG Reserved, _Out_writes_bytes_to_(Size, *ReturnedSize) PRTL_PROCESS_MODULES ModuleInformation, _In_ ULONG Size, _Out_opt_ PULONG ReturnedSize)
NTSTATUS NTAPI LdrLoadAlternateResourceModule(_In_ PVOID Module, _In_ PWSTR Buffer)
NTSTATUS NTAPI LdrVerifyImageMatchesChecksum(_In_ HANDLE FileHandle, _In_ PLDR_CALLBACK Callback, _In_ PVOID CallbackContext, _Out_ PUSHORT ImageCharacteristics)
UNICODE_STRING LdrApiDefaultExtension
VOID NTAPI LdrSetDllManifestProber(_In_ PLDR_MANIFEST_PROBER_ROUTINE Routine)
NTSTATUS NTAPI LdrDisableThreadCalloutsForDll(_In_ PVOID BaseAddress)
BOOLEAN NTAPI LdrInitShimEngineDynamic(IN PVOID BaseAddress)
NTSTATUS NTAPI LdrUnlockLoaderLock(_In_ ULONG Flags, _In_opt_ ULONG_PTR Cookie)
PLDR_MANIFEST_PROBER_ROUTINE LdrpManifestProberRoutine
BOOLEAN LdrpBreakOnRecursiveDllLoads
NTSTATUS NTAPI LdrGetDllHandleEx(_In_ ULONG Flags, _In_opt_ PWSTR DllPath, _In_opt_ PULONG DllCharacteristics, _In_ PUNICODE_STRING DllName, _Out_opt_ PVOID *DllHandle)
PIMAGE_BASE_RELOCATION NTAPI LdrProcessRelocationBlock(_In_ ULONG_PTR Address, _In_ ULONG Count, _In_ PUSHORT TypeOffset, _In_ LONG_PTR Delta)
NTSTATUS NTAPI DECLSPEC_HOTPATCH LdrLoadDll(_In_opt_ PWSTR SearchPath, _In_opt_ PULONG DllCharacteristics, _In_ PUNICODE_STRING DllName, _Out_ PVOID *BaseAddress)
LIST_ENTRY LdrpUnloadHead
NTSTATUS NTAPI LdrCreateOutOfProcessImage(IN ULONG Flags, IN HANDLE ProcessHandle, IN HANDLE DllHandle, IN PVOID Unknown3)
BOOLEAN NTAPI LdrFlushAlternateResourceModules(VOID)
NTSTATUS NTAPI LdrQueryProcessModuleInformation(_Out_writes_bytes_to_(Size, *ReturnedSize) PRTL_PROCESS_MODULES ModuleInformation, _In_ ULONG Size, _Out_opt_ PULONG ReturnedSize)
NTSTATUS NTAPI LdrDestroyOutOfProcessImage(IN PVOID Image)
NTSTATUS NTAPI LdrLockLoaderLock(_In_ ULONG Flags, _Out_opt_ PULONG Disposition, _Out_opt_ PULONG_PTR Cookie)
BOOLEAN LdrpShowRecursiveLoads
ULONG AlternateResourceModuleCount
NTSTATUS NTAPI LdrAddRefDll(_In_ ULONG Flags, _In_ PVOID BaseAddress)
BOOLEAN NTAPI LdrUnloadAlternateResourceModule(_In_ PVOID BaseAddress)
FORCEINLINE ULONG_PTR LdrpMakeCookie(VOID)
NTSTATUS NTAPI LdrFindEntryForAddress(_In_ PVOID Address, _Out_ PLDR_DATA_TABLE_ENTRY *Module)
NTSTATUS NTAPI LdrGetProcedureAddress(_In_ PVOID BaseAddress, _In_opt_ _When_(Ordinal==0, _Notnull_) PANSI_STRING Name, _In_opt_ _When_(Name==NULL, _In_range_(>, 0)) ULONG Ordinal, _Out_ PVOID *ProcedureAddress)
NTSTATUS NTAPI LdrEnumerateLoadedModules(_Reserved_ ULONG ReservedFlag, _In_ PLDR_ENUM_CALLBACK EnumProc, _In_opt_ PVOID Context)
BOOLEAN NTAPI LdrAlternateResourcesEnabled(VOID)
NTSTATUS NTAPI LdrSetAppCompatDllRedirectionCallback(_In_ ULONG Flags, _In_ PLDR_APP_COMPAT_DLL_REDIRECTION_CALLBACK_FUNCTION CallbackFunction, _In_opt_ PVOID CallbackData)
PIMAGE_BASE_RELOCATION NTAPI LdrProcessRelocationBlockLongLong(_In_ ULONG_PTR Address, _In_ ULONG Count, _In_ PUSHORT TypeOffset, _In_ LONGLONG Delta)
BOOLEAN NTAPI LdrVerifyMappedImageMatchesChecksum(_In_ PVOID BaseAddress, _In_ SIZE_T NumberOfBytes, _In_ ULONG FileLength)
#define LDR_LOCK_LOADER_LOCK_DISPOSITION_LOCK_NOT_ACQUIRED
#define LDR_GET_DLL_HANDLE_EX_UNCHANGED_REFCOUNT
_In_opt_ PVOID _Out_ BOOLEAN * Stop
#define LDR_LOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS
#define LDR_ADDREF_DLL_PIN
#define LDR_COR_OWNS_UNMAP
#define LDR_GET_DLL_HANDLE_EX_PIN
_In_ PCWSTR _Out_ PVOID * ActCtx
#define LDRP_DONT_CALL_FOR_THREADS
#define LDR_LOCK_LOADER_LOCK_FLAG_TRY_ONLY
#define LDR_LOCK_LOADER_LOCK_DISPOSITION_INVALID
#define LDR_LOCK_LOADER_LOCK_DISPOSITION_LOCK_ACQUIRED
LDR_MANIFEST_PROBER_ROUTINE * PLDR_MANIFEST_PROBER_ROUTINE
#define LDR_UNLOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS
#define LDRP_PROCESS_ATTACH_CALLED
LDR_ENUM_CALLBACK * PLDR_ENUM_CALLBACK
VOID NTAPI LdrpGetShimEngineInterface()
static const char const char * DllPath
static OUT PIO_STATUS_BLOCK IoStatusBlock
_In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _Reserved_ ULONG _In_opt_ PUNICODE_STRING _In_ ULONG _Out_opt_ PULONG Disposition
#define DPFLTR_WARNING_LEVEL
_In_ HANDLE ProcessHandle
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID * BaseAddress
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T _Inout_opt_ PLARGE_INTEGER _Inout_ PSIZE_T ViewSize
NTSYSAPI BOOLEAN NTAPI RtlTryEnterCriticalSection(_In_ PRTL_CRITICAL_SECTION CriticalSection)
NTSYSAPI ULONG __cdecl DbgPrintEx(_In_ ULONG ComponentId, _In_ ULONG Level, _In_z_ _Printf_format_string_ PCSTR Format,...)
NTSYSAPI NTSTATUS NTAPI RtlEnterCriticalSection(_In_ PRTL_CRITICAL_SECTION CriticalSection)
NTSYSAPI NTSTATUS NTAPI RtlLeaveCriticalSection(_In_ PRTL_CRITICAL_SECTION CriticalSection)
DECLSPEC_NORETURN NTSYSAPI VOID NTAPI RtlRaiseStatus(_In_ NTSTATUS Status)
struct _RTL_PROCESS_MODULE_INFORMATION RTL_PROCESS_MODULE_INFORMATION
#define RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_FORMAT_WHISTLER
_In_ PMEMORY_AREA _In_ PVOID _In_ BOOLEAN Locked
#define _Out_writes_bytes_to_(s, c)
NTSYSAPI VOID NTAPI RtlCopyUnicodeString(PUNICODE_STRING DestinationString, PUNICODE_STRING SourceString)
#define SECTION_MAP_EXECUTE
NTSYSAPI NTSTATUS NTAPI RtlUnicodeStringToAnsiString(PANSI_STRING DestinationString, PUNICODE_STRING SourceString, BOOLEAN AllocateDestinationString)
NTSYSAPI NTSTATUS NTAPI RtlAppendUnicodeStringToString(PUNICODE_STRING Destination, PUNICODE_STRING Source)
NTSYSAPI BOOLEAN NTAPI RtlEqualUnicodeString(PUNICODE_STRING String1, PUNICODE_STRING String2, BOOLEAN CaseInSensitive)
#define NtCurrentProcess()
NTSYSAPI NTSTATUS NTAPI NtQueryInformationFile(IN HANDLE hFile, OUT PIO_STATUS_BLOCK pIoStatusBlock, OUT PVOID FileInformationBuffer, IN ULONG FileInformationBufferLength, IN FILE_INFORMATION_CLASS FileInfoClass)
NTSTATUS NTAPI NtClose(IN HANDLE Handle)
NTSYSAPI VOID NTAPI RtlFreeUnicodeString(PUNICODE_STRING UnicodeString)
#define UNICODE_STRING_MAX_BYTES
_In_ ULONG _In_ ULONG _In_ ULONG Length
NTSYSAPI NTSTATUS NTAPI LdrpApplyFileNameRedirection(_In_ PUNICODE_STRING OriginalName, _In_ PUNICODE_STRING Extension, _Inout_opt_ PUNICODE_STRING StaticString, _Inout_opt_ PUNICODE_STRING DynamicString, _Inout_ PUNICODE_STRING *NewName, _Inout_ PBOOLEAN RedirectedDll)
BOOLEAN LdrpShutdownInProgress
BOOLEAN NTAPI LdrpCheckForLoadedDllHandle(IN PVOID Base, OUT PLDR_DATA_TABLE_ENTRY *LdrEntry)
NTSTATUS NTAPI LdrpLoadDll(IN BOOLEAN Redirected, IN PWSTR DllPath OPTIONAL, IN PULONG DllCharacteristics OPTIONAL, IN PUNICODE_STRING DllName, OUT PVOID *BaseAddress, IN BOOLEAN CallInit)
PVOID g_pShimEngineModule
VOID NTAPI LdrpUpdateLoadCount2(IN PLDR_DATA_TABLE_ENTRY LdrEntry, IN ULONG Flags)
#define LDRP_UPDATE_DEREFCOUNT
PLDR_DATA_TABLE_ENTRY LdrpCurrentDllInitializer
ULONG LdrpActiveUnloadCount
VOID NTAPI LdrpFinalizeAndDeallocateDataTableEntry(IN PLDR_DATA_TABLE_ENTRY Entry)
NTSTATUS(NTAPI * PLDR_APP_COMPAT_DLL_REDIRECTION_CALLBACK_FUNCTION)(_In_ ULONG Flags, _In_ PCWSTR DllName, _In_ PCWSTR DllPath OPTIONAL, _Inout_opt_ PULONG DllCharacteristics, _In_ PVOID CallbackData, _Outptr_ PWSTR *EffectiveDllPath)
PLDR_DATA_TABLE_ENTRY LdrpGetModuleHandleCache
NTSTATUS NTAPI LdrpGetProcedureAddress(_In_ PVOID BaseAddress, _In_opt_ _When_(Ordinal==0, _Notnull_) PANSI_STRING Name, _In_opt_ _When_(Name==NULL, _In_range_(>, 0)) ULONG Ordinal, _Out_ PVOID *ProcedureAddress, _In_ BOOLEAN ExecuteInit)
BOOLEAN NTAPI LdrpCheckForLoadedDll(IN PWSTR DllPath, IN PUNICODE_STRING DllName, IN BOOLEAN Flag, IN BOOLEAN RedirectedDll, OUT PLDR_DATA_TABLE_ENTRY *LdrEntry)
BOOLEAN NTAPI LdrpCallInitRoutine(IN PDLL_INIT_ROUTINE EntryPoint, IN PVOID BaseAddress, IN ULONG Reason, IN PVOID Context)
VOID NTAPI AVrfDllUnloadNotification(IN PLDR_DATA_TABLE_ENTRY LdrEntry)
VOID NTAPI LdrpRecordUnloadEvent(_In_ PLDR_DATA_TABLE_ENTRY LdrEntry)
RTL_CRITICAL_SECTION LdrpLoaderLock
#define LDRP_UPDATE_REFCOUNT
PUNICODE_STRING LdrpTopLevelDllBeingLoaded
ULONG NTAPI LdrpClearLoadInProgress(VOID)
PVOID g_pfnSE_DllUnloaded
PLDR_DATA_TABLE_ENTRY LdrpLoadedDllHandleCache
#define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
#define STATUS_INTERNAL_ERROR
#define STATUS_IMAGE_CHECKSUM_MISMATCH
#define STATUS_DLL_NOT_FOUND
#define STATUS_INVALID_PARAMETER_2
#define STATUS_NO_MORE_ENTRIES
#define STATUS_DLL_INIT_FAILED
#define STATUS_INVALID_PARAMETER_1
#define STATUS_INVALID_PARAMETER_3
#define STATUS_NAME_TOO_LONG
#define IMAGE_DIRECTORY_ENTRY_IMPORT
#define FileStandardInformation
#define _SEH2_GetExceptionCode()
#define _SEH2_EXCEPT(...)
_CRT_RESTORE_GCC_WARNINGS _CRT_DISABLE_GCC_WARNINGS _Check_return_ _CRTIMP _CONST_RETURN char *__cdecl strrchr(_In_z_ const char *_Str, _In_ int _Ch)
#define DECLSPEC_HOTPATCH
PVOID NTAPI RtlDecodeSystemPointer(IN PVOID Pointer)
VOID WINAPI SE_DllUnloaded(PLDR_DATA_TABLE_ENTRY LdrEntry)
base of all file and directory entries
PACTIVATION_CONTEXT EntryPointActivationContext
UNICODE_STRING FullDllName
LIST_ENTRY InLoadOrderLinks
LIST_ENTRY InInitializationOrderLinks
LIST_ENTRY InMemoryOrderLinks
UNICODE_STRING BaseDllName
struct _LIST_ENTRY * Blink
struct _LIST_ENTRY * Flink
LIST_ENTRY InInitializationOrderModuleList
LIST_ENTRY InMemoryOrderModuleList
#define RTL_CONSTANT_STRING(s)
#define FIELD_OFFSET(t, f)
#define RtlZeroMemory(Destination, Length)
#define CONTAINING_RECORD(address, type, field)
#define STATUS_INVALID_PARAMETER
#define STATUS_NO_SUCH_FILE
#define STATUS_INFO_LENGTH_MISMATCH
#define STATUS_OBJECT_NAME_NOT_FOUND
VOID(NTAPI * PLDR_CALLBACK)(PVOID CallbackContext, PCHAR Name)
_Must_inspect_result_ _In_ WDFDEVICE _In_ PWDF_DEVICE_PROPERTY_DATA _In_ DEVPROPTYPE _In_ ULONG Size
_In_ WDFINTERRUPT _In_ PFN_WDF_INTERRUPT_SYNCHRONIZE Callback
_Reserved_ PVOID Reserved
_IRQL_requires_same_ typedef _In_ ULONG _In_ UCHAR _In_ ULONGLONG _In_ ULONGLONG _In_opt_ PEVENT_FILTER_DESCRIPTOR _Inout_opt_ PVOID CallbackContext
_At_(*)(_In_ PWSK_CLIENT Client, _In_opt_ PUNICODE_STRING NodeName, _In_opt_ PUNICODE_STRING ServiceName, _In_opt_ ULONG NameSpace, _In_opt_ GUID *Provider, _In_opt_ PADDRINFOEXW Hints, _Outptr_ PADDRINFOEXW *Result, _In_opt_ PEPROCESS OwningProcess, _In_opt_ PETHREAD OwningThread, _Inout_ PIRP Irp Result)(Mem)) NTSTATUS(WSKAPI *PFN_WSK_GET_ADDRESS_INFO
_Must_inspect_result_ _In_ ULONG Flags
_In_opt_ PVOID _Out_ PLARGE_INTEGER Cookie
_In_ PCALLBACK_FUNCTION CallbackFunction